Analysis

  • max time kernel
    123s
  • max time network
    132s
  • platform
    android_x64
  • resource
    android-x64-arm64-20240514-en
  • resource tags

    androidarch:armarch:arm64arch:x64arch:x86image:android-x64-arm64-20240514-enlocale:en-usos:android-11-x64system
  • submitted
    17-05-2024 04:51

General

  • Target

    4e7d171fcdcc00e1882872750b1f8fe6_JaffaCakes118.apk

  • Size

    5.8MB

  • MD5

    4e7d171fcdcc00e1882872750b1f8fe6

  • SHA1

    e71bc1f849bd0afb0b36a3ee3574577cedb90cdb

  • SHA256

    8386715c5fc28c0c5de37fbde8004c29ad1022b15141107633b2b48799fa0df7

  • SHA512

    43be43293f73d18ae861109e11c7afbc8759819ca01431ac5b3720da52db320b661acb87dfa666ac490c907e0fe383e87911af9bef9b9979eeb8ce6042c503ff

  • SSDEEP

    98304:M0XCcDlfLwJ55mHgLljLWH6yE6eQTsddYU46uR3M13PxuqUsRt/OI5w5tPP:9XCcDljwfJLWH68pKcRhqUGUUw5dP

Malware Config

Signatures

  • Checks if the Android device is rooted. 1 TTPs 3 IoCs
  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Requests cell location 2 TTPs 2 IoCs

    Uses Android APIs to to get current cell location.

  • Checks the application is allowed to request package installs through the package installer 1 TTPs 1 IoCs

    Checks the application is allowed to install additional applications (Might try to install applications from unknown sources).

  • Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.

  • Queries information about the current nearby Wi-Fi networks 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to collect information about the current nearby Wi-Fi networks.

  • Acquires the wake lock 1 IoCs
  • Checks if the internet connection is available 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Schedules tasks to execute at a specified time 1 TTPs 1 IoCs

    Application may abuse the framework's APIs to perform task scheduling for initial or recurring execution of malicious code.

Processes

  • parseh.logo.two
    1⤵
    • Checks if the Android device is rooted.
    • Requests cell location
    • Checks the application is allowed to request package installs through the package installer
    • Queries information about the current Wi-Fi connection
    • Queries information about the current nearby Wi-Fi networks
    • Acquires the wake lock
    • Checks if the internet connection is available
    • Schedules tasks to execute at a specified time
    PID:4489

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/user/0/parseh.logo.two/databases/__pushe_base_lib_db

    Filesize

    24KB

    MD5

    776dacdfb78ddbd4037b7f51e0a60b8d

    SHA1

    bc790247307ff232cc32c65e80c65d72756d3f70

    SHA256

    b174ccb9077887fe020e09a0cb4247f8f42788fd5d56ec169138c93d57b4eb72

    SHA512

    d2f9b7621a2be4532ed996fa4ed05e8a19b3c1932febfd552a059342a9d824b2cd373328b7432801c7dadae632ed0b71bca81d9a8ca0ed851b55654ab9fd0fc1

  • /data/user/0/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    7e885eb9d1995f4363571e548d9c653c

    SHA1

    b8efbe7749d037626c812917ce392d74c0c78266

    SHA256

    0cb750a9e953e831940b124f5dc7cdb9a31fe3b28e301ce91e0b7185ae1674b6

    SHA512

    ff96fb3f8cc968db9799bc9751724439eb38066598665f80cf98e2617ca74d67118602d3dd5850c6f8a5789a0951f2c01cd7eb5bac2a24552e01b17806db8b5b

  • /data/user/0/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    7d59e294814107014da6c42400536af5

    SHA1

    38460bc66e3af527075fe731d303c6ca2803ca21

    SHA256

    2b5724ec1e9681a1f39ef33f337d601b6809f66a0ddee74667397cd5495af706

    SHA512

    d7d59e93d6814315d37bb0155cf8f6e60214df97084cd1bbd335f3e7d575d04f597ec896b7ca4549737ac598309fdee234a0cd500bbb584230489155f4f076b7

  • /data/user/0/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    8594740867a7eaf6abca6e8a04f6d39d

    SHA1

    42a0e5bf0ae85486435ee06e5aa72a63ac7748d4

    SHA256

    0d8b33abc020b72d8b9d86958be2fdf83b8fe1cbd37c535057bb6986fe21eecb

    SHA512

    f52c34904646b98486448c3e0f0f190762cd0f7362e7eb63af530ae757a5891df93d513779926aa75760bb9f2d3bb31f5bf22fd5ce6f6ead7d8a7c7fa4166e49

  • /data/user/0/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    8KB

    MD5

    0978344f2d07d3fefb16ba9880196cf8

    SHA1

    6eca81e72ccc9afd98fddf1ca5768cae1f85f76c

    SHA256

    20ed2ec1218b6e8f36107a13f0e1c2a8ba9f575806f528fef0b8786b48352f3d

    SHA512

    6dac16fb41e8ca553b2e4061296177a68ddfb50232c8dc510fb8ef5ff74870a05d71ed25ba0d5d07f6c160ca08715bf59a8e00567753d1203625c2f009b7cf12

  • /data/user/0/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    24KB

    MD5

    78b724b4897855e95acd16cc4b1f3a0d

    SHA1

    ff625ab6d6ca1b853053b29e3813e0ecbacdebf0

    SHA256

    917863e0f46eda541998aca54c001242885314b557b4cc4229072a5dc9b66d6e

    SHA512

    bdf8d6d2be67287c4c264f6726d12015ec72a4b85361184e9392ca1d42a080635f27368e97bd32345f0505d10884db90029e6ef14ca7d71a4883aa47aee3c7c6

  • /data/user/0/parseh.logo.two/databases/__pushe_base_lib_db-journal

    Filesize

    512B

    MD5

    c2b9d975beb9fb4796ce1ffd1ec409d2

    SHA1

    9f0def66e422df87a072c5cb7620581a1a77bc1a

    SHA256

    d663471902b1a75c1f2c82a383cdc0d2d0ac89bdff15ab7fa0727055265551c5

    SHA512

    e13a2a7735224ebcc04a61cb6ada540eff2ed8fafbb93fe6106a5a425bea1e26f2f5329ee78ceef54112ec85903a0f1034e27830c8b55cfb57cd9140edead187

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    b93d349780a9bfbb3b0b12304eb99806

    SHA1

    22a735174bcec10f93b51f406266c12048abcb42

    SHA256

    b879f905e4d7dc0f040e080c8c294d43a9003c4a4d20496a628372d6e5042d8d

    SHA512

    30be0cc76dd537458601fedd1bf2d50edf022428fe60395b3cf9ca672a884682c917a99e728dc5c648d4f62af41f3069151704217731f4f97387d460c0f49de9

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    8554cf5adedb682298d5f3d2411cb6dc

    SHA1

    ebf6aff15e943f3fd20b45bae710b4b8c782eae2

    SHA256

    7f8df68a4150b9b7bc91cc5a1243a134cde6027973501b117f7e52da0186373a

    SHA512

    ea90005ed9e485f189d2053ef277e5bf4fc4e87be4bcc099816fbb647d413e7662801706d24fe44fbb1bc6ed2f4f19272363a8de3f65e7599d8fcb3df534241b

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    82ee0db32581286180af3ce61d5e9523

    SHA1

    fc2bb9f1295372648f4c2c4606335b9755a60229

    SHA256

    0ee5b73852985a92c0694217c86ee0989a62987a5f08b64bea4495ad8bc0b427

    SHA512

    42b981e2dcacf04cb62805fc0ce87c4752d930869f106be6d1ed6ada600b0157841682bbfba8932bb3a816c23debc7f73baff4b7cc2e80b1608e8a8613acdc46

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    8188a223c968b77eb4ff1474d0ac58cc

    SHA1

    a0119bdf99cbbef380a2089b9abd18d36baa1380

    SHA256

    8630072f33d7557efdd47d1561ca01c807f3d95c842e77e8a4548ed4e7026c40

    SHA512

    a3c2238062dcedb9a696f92ef7768067c6febee5136417106798c18d79fb0310b8052a1a220a0e3d06578b5553b7b0c151c29b49336cca50beda04043e55d22a

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    47080e3bfcf2db9b8620f2faf6c5857a

    SHA1

    6f63c1851255e0fa99567f047382074b086d38bc

    SHA256

    dc4f8a73f49d2a6b41ff425fd08b85c1eba5280c438a1a1ff9832e91dfa56cbb

    SHA512

    e757043d82798926a5ddd716457accf6616894ad1ad79ec832293a1f662910b663239f899bf05a5c8d90fed5bcb093c5529e5bc842fe9003c1d5902f9ed84473

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db

    Filesize

    16KB

    MD5

    209e235aec1a87462824ac3d67de26b7

    SHA1

    5c87982b8028d3a4f4291abf83a64ef114bd5038

    SHA256

    33e4ed5e2eefe2cbea1d4c9c30cf7ea538492ea96a46886caf8dd90d700efddb

    SHA512

    1e03393665111dc4786d76151ff0506493110e4fa724cf17f49e9ba5fdfb3157711b0c0bd14f83af8cd1ee9cf7a5f8b06c5cd7fedb62b539a9a3fcc3e9707393

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    02724c2e29e68db4f5414ad398464819

    SHA1

    84079864ea5ed3e69e38384058787693af2f49f2

    SHA256

    40f9b67bb31729435a40d4ed2fc23237715fb2414595a91f80d3eb93d1c94004

    SHA512

    5537930ae39864d446f58abf651ea914595981f4beb35e1bd3de6a801646bec2c9708953d058d22ca71f8d9ad7ba981e066e72befb7ae910f897d1fc7adbcccb

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    894dbd5902365581bac1124056956050

    SHA1

    eb001a54d6cd8a9dc7ce2e1618d275b6b6452197

    SHA256

    11b1f4a3d09c32987487e98504b0cf7e9211e18381e6c555e6d58e656f9d1fe3

    SHA512

    575030726bdcc235ba52f7dea9b1ed0216e716447b2640a2be6b5c1aec96747c4f5623538fc507b9c0657a693a610bfff515ff19f4e649c6f9f0d8acbc56d092

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    512B

    MD5

    d7bd644d0ff702a6a9123826d1915e62

    SHA1

    d4e8411a06bbfc799dab9268a1d601fa0740fcb6

    SHA256

    032af224aa5e78e7c8c25870907fe7e975ea2a4b72aff9be999e303f2e15d57e

    SHA512

    523799ec004b309e596c8b0c3e5dd834bb8b501f60b4702025b79141684c10002443943b601b36a8ddae03d2a2f36ab03bef03e4370e6e7c470b230eed0d2887

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    002cc3b19d2bff46ccb57b57f5f40e13

    SHA1

    584cb2b30fe1fcaa279d85f1400720d31a27c7e2

    SHA256

    7eb77a3e93dfb3993ca587ca011c412c89b98a5ba9de0f4cf6c3b5853fd63b84

    SHA512

    88b4a37647c7dd3b127f6aba98761390a0543d9c2ae0786543748baacda3988484dac2099497d0759e54e8bcd8c47caeb675b7e3d2348dff6b72ac2931f73734

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    2afe9943b53f307221fca42c904833da

    SHA1

    f98fe296fe4ae78568e971c6bbdc239a77ad90f2

    SHA256

    b3540be48a75be66cc2a5e7aebe636b7d5b650733e3695e43264b8f0e1e2a56b

    SHA512

    aed830d1fc77bcdccf8a419a15ec86c5ddeb4989fe57a210abccfd6be44da194781cb8d1a3f0f7da69fb2b4d0afdfaacc0d1e132f0afd5c61b1204ca475a3870

  • /data/user/0/parseh.logo.two/databases/evernote_jobs.db-journal

    Filesize

    8KB

    MD5

    9708fd4d51d6e69b3c70bc41f9f5bee5

    SHA1

    a076afe3f61944b4cbb203c95ffbecaff4173875

    SHA256

    4ae6d788807a83543197541468972ac42552d131509999e9f62f90c03c9ab4c2

    SHA512

    f4be0faaf90f2b700575c11197879fa6d031f98891887754589d48b4fc17728ae415f0b82d116967f23dbec5934595840e58ebd87648be9dc9abe3fc26ba9a54

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads

    Filesize

    36KB

    MD5

    f73e6bbf9b484f89037480ed1ffdf3d0

    SHA1

    6e452a8b856956a331299bee8bdda4e3be3ed6b1

    SHA256

    4beb9ca21b7e7dccf054ffdb3d02169caff8cd3a01f58c763c8f07481b3ef672

    SHA512

    b85619c3571d6ef4e1d0df8477193ab8190d547e82e482b82ca754504d754e32110c81e82d0a139ea524961ad08e5a61bd4c0afd1de5e8752fd160208b24c1a6

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads

    Filesize

    28KB

    MD5

    e250400dd81d6c1eab2381f9e611b4b2

    SHA1

    d50deca82c2b38227254ad5662c5a59c7169dd86

    SHA256

    ec9e9f51d149d600131dfc1262eb25c85ca4dccda54da194bc222678741d48b0

    SHA512

    7d5768018ca96ed255d9880f851972ade6dc4b789208df3bb9880c36b935017e885c8ced49d944d79944e3a8264c9e72103e9d337f50441716d45230680cb590

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads

    Filesize

    28KB

    MD5

    453210ce1af5ac6418962ae9b76443c3

    SHA1

    91d562d2fc2a242f5cbc273c70a05f92059da4be

    SHA256

    488c39fad62924cbd03c78a4c8d2f76fc3de8787e4ef7d6d0adfc340079947da

    SHA512

    847c83461606899af930c68ecf0dc803e7087e7969b316f1147db359f691d3074579dd4fb8d9a5f9a7ac9dea89b4a95f0263d6ebcbdd7e29db4e9285ccab7599

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    512B

    MD5

    53314b69c92d87666ae5804de7038eec

    SHA1

    6943cc1bfa1220dd69fc80524e80506970d4e35f

    SHA256

    bab45cadd0195eaf748e42ab2fec1b2ffd371e09a4bd5540a15a8826c69b5b8d

    SHA512

    41e168bc4c677f339276db252ee7caab08141f7e340f75d81745932b1dce6cb5bf18964f1808ff4dace60db53e53f520f199d943645a707d2f59de04a6a7d08e

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    8KB

    MD5

    15c5f7fcd96de6f5a1d80a2b4ab6743c

    SHA1

    f7845d5670d6fb227f07821511108812a7bc28db

    SHA256

    d6b36735ec49029d36df7a12024dd82cd77e79dd120a1765f493d990c4a08bf1

    SHA512

    fa8a78e6fce902b741d3b143002941db01ea0c51ed2112e8e6333b6e81e6e704dfec05e88b4b432ab0ed535e2b61fd8b282e47522e78b0ae694095f0b6d76d7a

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    8KB

    MD5

    d232f127d381ddc590f5e12a9ff971e6

    SHA1

    e383e7a3face1301390aa4965a04cac823851f29

    SHA256

    4e87e08e7bdb01a48323cf9c40db9778b40cf278b5f2e40f466de3c82cb99b8c

    SHA512

    e9bdb29c6730c750271512f355cf8b8e1d2fcf86a7dd8258eeefca694d1a5b9893c838123eea49604f8b635c3755885a2574a373de848fc7aa7044e4b717b7da

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    12KB

    MD5

    98cfb5c584a072920f50904135d8396b

    SHA1

    82d8857fb48f04ffeca67423f91afdcb81b05e66

    SHA256

    d3bc0973d8eb399ad6c894325b7db10458d9c28f6a5cc883794fa396573fa552

    SHA512

    2dc366f4fb315ca2142ec67c63594a6e64f25810b6857ab36b124bd1ced93bf1f52adb696bc3d90c169b62e749cc555820b483a682bf3d195a33801d60d5f925

  • /data/user/0/parseh.logo.two/databases/ir.tapsell.sdk.ads-journal

    Filesize

    12KB

    MD5

    d6740a149bf3d3c1c0da0d4f8a08137d

    SHA1

    02b9dd89d99f16cfd83223bb2119643af22a1ea2

    SHA256

    8086f574b97a502ee8429874d70963f7336611a84d12b41c94d3b791b94cf4a8

    SHA512

    02468fafda51de96d6f65b2de7bbcfc6eabe8549726d7a0d3463ffafef5a493a6eb504bc8255754f8de4b534d804ea9ca028662a06c0602242f68c55bfda7257

  • /data/user/0/parseh.logo.two/databases/tap.db

    Filesize

    44KB

    MD5

    0854c610436dadcbb743b96cabb3dbc9

    SHA1

    41b9835568cdf26a7e3f4df73cb8b08b50022982

    SHA256

    0708d030ed80a593f272a70ceb6a2dbe8cb1fbfba553bc1372d5ab187bf06845

    SHA512

    e1b878c482375f34fad6dc9021e8edba84ece7103137c39dacd144b8a9ef92713215f23236067aaa7dabb7f8103651c138023ca0dbc3cbd993e6a9b0b99b0801

  • /data/user/0/parseh.logo.two/databases/tap.db-journal

    Filesize

    512B

    MD5

    d78eeaecb93015682a51f348176aa0b5

    SHA1

    424ab21ee6870cdaa5c4fe00b80540d8f630adb7

    SHA256

    f8a9650dc7101cafe8f1190fe13f8ad57b302a124b26bc29136e2ee0eb5a1f84

    SHA512

    6436961813187b6ca2303a028c6dcfd0f7d31f5634a561d300cdc1e178e6ad2f8d4d9f1b5f699b2b654dbf74470266e4172c5e9b84577054c90bd84aa26329cb

  • /data/user/0/parseh.logo.two/databases/tap.db-journal

    Filesize

    8KB

    MD5

    cf00dcac04d8b60609d8212dc6c817a1

    SHA1

    dc8afa442043bc9d03d85b28fe82ced525382adf

    SHA256

    09b998193dbdb6265cc872358ebaf5b58caaa0f2d2432fb045eeb0f106c037bb

    SHA512

    c3d8468db8086bc3a260c427cbe02e25874078dc1d012e61ae5bac953c8cb9a1a3758392fc7c0f3df0ae58ed0a54a24c6e837a7b0642d14205d9bb18a8a1f912

  • /data/user/0/parseh.logo.two/databases/tap.db-journal

    Filesize

    8KB

    MD5

    72098fbc7aaba46592f8203d818e3eaf

    SHA1

    7990a871cc23af5e3b8e47eba3b9157e8c9ff4eb

    SHA256

    91c89bbec1cbefc187d97f6bc11dc74cbbe7496442549e1dff3f189a7d4c1c6a

    SHA512

    47a19e5b329e53b4a7aa33daed4415a4a5c1d3bc811f81a222a9a79b7b0c70dddebfa0e71394d771d3203b903190d5c67937c2d9d56c9a7f44b3a27afd80cc2c

  • /data/user/0/parseh.logo.two/databases/tap.db-journal

    Filesize

    12KB

    MD5

    4e9121b57a511edd54aefb1cf6416613

    SHA1

    70a6efcbfb210f4121e9f3dd4c0057c2ba324a24

    SHA256

    2f5f28a4c1fb8236d2bfaf182523b0c0332275dae521b69832acba5915b7acc2

    SHA512

    91c5f8fafdb85b4bd39adc3378e0d6d8994e3bf0c53c5301a23a243c4ba369a1edbd0f0336542ec920d7bd2af9457a5007a3299520aa1a1b77a1fb2a013652fd

  • /data/user/0/parseh.logo.two/files/fonts/bkoodb.ttf

    Filesize

    3KB

    MD5

    42ed81df7776b8b0ce4272a0928a2565

    SHA1

    51d7d6847c17547d17f5e658341022f0c1566ca8

    SHA256

    25d3f3d41f695978a1920935a09c2839ea1cc221191aab12dbb03560156a72a4

    SHA512

    76a9bf954af4cf14e909ead307ff46bd978b01bc25aa7b30a565cf7128b55166c8381e5cabf05705d271dbf8301e2f6834cf4dc3285dc2d17a05ba76da3ea33c

  • /data/user/0/parseh.logo.two/files/unsent_requests

    Filesize

    58B

    MD5

    0d210bfb2a0e1f1b4c082a6a0f79de07

    SHA1

    bb8ed9e364db79d1d9f2fcde3f15091893222faa

    SHA256

    988722c23d78a46021d0e7ca9deee7aa8bb83288269174ffacb7316f381cca1d

    SHA512

    536e9867b0df29b15b789f8949be6ab37fcdeccb9d39ded981da7dc2052c9533d0ec0e6f9a5444132977605d372e1463d91bdde41b528ff2ca3f65ab152325c1